Privacy Policy
Welcome to The Callsheet ("we," "us," or "our"), a daily cinema puzzle game, film trivia dispatch, and social movie club platform operating at https://callsheet.quest (the "Service"). This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have regarding your data.
Summary in Plain English: You can play The Callsheet as a Guest without creating an account. If you choose to sign in (via Google, GitHub, Email/Password, or Magic Link) to sync your streaks, badges, and league scores across devices, we only store your basic profile (email, display name, and avatar) and your in-game trivia progress. We never sell your personal data, never run third-party behavioral ad trackers, and never access sensitive scopes.
1. Information We Collect
A. Account & Authentication Data (Optional Sign-In)
You may play The Callsheet in Guest Mode without providing any personal information. If you choose to register or sign in to a Cinephile Pass account, we authenticate you via Supabase Auth using your choice of Email & Password, passwordless Email Magic Link / 6-digit OTP code, Google OAuth, or GitHub OAuth. When you sign in, we collect and store:
- Email Address: Used strictly to identify your account, maintain your login session, and send transactional authentication links or 6-digit verification codes.
- Display Name / Handle: Provided by you during registration or populated from your OAuth profile (`name` / `full_name`) so it can be shown on leaderboards and within leagues you join. You can customize this name at any time.
- Profile Avatar: Your selected in-app cinema avatar preset (e.g., `preset:director`) or the profile picture URL (`avatar_url` / `picture`) provided by your OAuth provider.
- Account Identifier (UUID): A unique internal user ID generated by Supabase Auth to link your game progress to your profile.
B. Gameplay, League & Community Data
To power leaderboards, streaks, prop vault badges, and film clubs, we store the following gameplay data associated with your profile in our database:
| Data Category | What Is Stored | Purpose |
|---|---|---|
| Player Profile & Season Stats | Season points, raw points, season rank, games played, weekly streaks, and accuracy rate | Computing individual, department, and squad leaderboard standings |
| Daily Reel Completions | Puzzle day number, puzzle type, solved status, guess count, movie guesses submitted, points earned, and completion timestamp | Saving your daily streak across devices and calculating community solve rates and guess distributions |
| Badges & Prop Vault | Unlocked badge identifiers (`badge_id`) and unlock timestamps | Persisting your earned cinema props and achievements in your account vault |
| Leagues, Pools & Votes | Joined Office Pool / Film Club IDs, department or subgroup selection, custom squad memberships, and weekly Watercooler Poll votes | Enabling team competitions, custom friend leagues, and community film polls |
C. Local Browser Storage (localStorage)
Whether you play as a Guest or a signed-in user, The Callsheet uses standard browser localStorage on your device to store:
- Your active authentication session token (
sb-*-auth-token) and cached user profile so you stay signed in across page reloads without flicker. - Your daily puzzle guesses, solo trivia pack progress, earned badges, and audio mute preferences.
- A small local diagnostic ring buffer (capped at the last 25 client errors) for troubleshooting.
No Third-Party Ad Cookies: We do not use third-party advertising cookies, cross-site tracking pixels, or behavioral profiling scripts.
D. Diagnostic & Error Telemetry
If the web application encounters an unhandled JavaScript or React error, our client telemetry utility automatically logs a diagnostic report containing the error message, stack trace, component stack, current page URL/pathname, browser userAgent string, viewport dimensions, and timestamp. This data is used solely to diagnose and fix software bugs.
2. Google API Services & OAuth Limited Use Disclosure
When you choose "Continue with Google," we request only basic, non-sensitive OpenID Connect scopes (openid, email, and profile).
- How We Use Google Data: We use your Google email address, display name, and profile picture URL solely to authenticate your identity and populate your player profile in The Callsheet.
- No Advertising or Data Brokerage: We never sell, rent, or trade Google user data to third parties, never use it for targeted advertising, and never use it to train artificial intelligence or machine learning models.
- Google Limited Use Compliance: The Callsheet's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
3. How Information Is Shared
We do not sell your personal information. Information is shared only in the following limited contexts:
- In-Game Leaderboards & Leagues: The Callsheet is a social trivia and puzzle game. Your display name, avatar, unlocked badges, department/squad affiliation, and game scores are visible to other participants on community leaderboards and within Office Pools or Film Clubs you join.
- Aggregated Community Statistics: Your Daily Reel completion results (such as how many guesses a puzzle took) are aggregated with other players' results to display community solve rates and guess distributions.
- Infrastructure Subprocessors: We rely on trusted industry-standard infrastructure providers to host and operate the Service:
- Supabase: Authentication management and hosted PostgreSQL database storage.
- Cloudflare Pages: Static web hosting, content delivery network (CDN), and network security.
- Google & GitHub: Optional OAuth identity providers when initiated by you.
- Legal Compliance: We may disclose information if required to do so by law or in response to valid legal process.
4. Data Retention, Security & Account Deletion
All traffic between your browser and The Callsheet is encrypted via HTTPS/TLS, and database tables are protected by Supabase Row-Level Security (RLS) policies so only you can modify your own profile, completions, badges, and votes.
- Clearing Guest / Local Data: You can clear all local game data at any time by clearing your browser's site data /
localStorageforcallsheet.quest. - Deleting Your Registered Account: You may request complete deletion of your Cinephile Pass account at any time by emailing us at support@callsheet.quest from the email address associated with your account. Our database schema enforces
ON DELETE CASCADE, which permanently deletes your profile, daily completions, badges, team memberships, and poll votes within 7 days of your request.
5. Your Privacy Rights (GDPR, CCPA & Global Users)
Depending on your location, you have the right to access, correct, export, or request deletion of the personal data we hold about you. You can update your avatar and league memberships directly inside the application, or contact us at support@callsheet.quest to exercise any data subject rights.
6. Children's Privacy
The Callsheet is intended for general audiences and is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have inadvertently collected personal data from a child under 13, we will promptly delete it.
7. Changes to This Privacy Policy
We may update this Privacy Policy from time to time as we add new features. When we make material changes, we will update the "Effective Date" at the top of this page.
8. Contact Us
If you have any questions about this Privacy Policy, our data practices, or an account deletion request, please contact us at:
Email: support@callsheet.quest
Website: https://callsheet.quest